Field of the Invention
This invention generally relates to methods and systems for evaluating access policy changes, and more specifically, to methods and systems for determining how a policy change would have influenced past actions as a predictor for future problems.
Background Art
It is often difficult for computer network administrators to be sure they are doing something both secure and efficient when they change policy information that controls user behavior. Prior art procedures for changing policy information generally focus on controlling access to information but do not apply to all potentially restrictive policy information.
An administrator may discover that some resource, like a discussion database, has its Access Control List (ACL) set to allow anyone to read it. To tighten security, they will remove that entry. Now, they need to be concerned with a surge of help desk calls from the people who were relying on that access to get their job done, who are not explicitly listed in the remaining ACL.
The concept of one active policy and several latent policies is known. Latent policies can be queried against before becoming active, to understand the impact of changes. However, most administrators who change policies do not know what to check, and what to ask about, and do not have the time to think about it.